OnlyFans API Access

Query OnlyFans data and analytics via the OnlyFansAPI.com platform. Get revenue summaries across all models, identify top-performing models, analyze Free Trial and Tracking Link conversion rates, compare link earnings, and much more! Use when users ask about anything related to OnlyFans.

This skill appears to do what it says (call OnlyFansAPI.com), but exercise caution before installing: the SKILL.md requires ONLYFANSAPI_API_KEY but the registry metadata omits that — verify with the publisher. Because the skill will use your API key and network access to app.onlyfansapi.com, only provide a key if you trust OnlyFansAPI.com (and prefer a scoped or read-only key for testing). Check that the agent is restricted to the expected domain, confirm the skill's publisher/source (there is no homepage), and ask the author to correct the registry to declare ONLYFANSAPI_API_KEY as the primary credential so automated checks and permissions are accurate.

Type: OpenClaw Skill Name: onlyfans-api Version: 1.0.0 The skill is classified as suspicious due to the broad permissions granted in `SKILL.md`. Specifically, `allowed-tools: Bash(curl:*) Bash(jq:*) Read` allows the agent to execute `curl` to any domain and read any file, which are risky capabilities. While the explicit instructions within `SKILL.md` only direct `curl` to `app.onlyfansapi.com` and do not instruct the agent to read sensitive files or perform other malicious actions, the wildcard permissions themselves represent a potential attack surface if the agent were to be further prompted maliciously.